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Remarks 



Applicant respectfully traverses the Examiner's rejection of claims 1-13 under 35 
USC 102(b) as being anticipated by Ji, et. al. (5,623,600.) 

The Examiner's rejection of claim 1 is based upon her assertions that: Ji's proxy 
server is the same as Applicant's protocol parser; and, Ji's proxy servers examine and 
intercept packets. Applicant respectfully disagrees with those assertions. 

First, Ji's proxy server is the not the same as Applicant's protocol parser. Ji's FTP 
and SMTP proxy servers operate on FTP and SMTP files and messages only . That means 
that there is no need for a protocol parser — the protocols that Ji's proxy servers operate 
on are predetermined: File Transfer Protocol and Simple Message Transfer Protocol. 
There is no mention, discussion, disclosure, teaching nor motivation in Ji of using a 
protocol parser, which is able to discriminate among different protocols. 

Thus, the Examiner cannot equate Ji's proxy servers with the protocol parser of 
claim 1. Ji's proxy server have nothing to do with discriminating between protocols of 
any particular packet By Ji's own account, they accept data of two particular protocols 
and have nothing to do with distinguishing any particular protocol. 

Thus, Applicant submits, the Examiner's rejection is misplaced. Ji does not 
disclose a protocol parser. 

Second, Ji's proxy servers do not examine and intercept packets. There is no 
mention, discussion, disclosure, teaching nor motivation in Ji of using either FTP or 
SMTP proxy server to examine and/or intercept packets. With all due respect to the 
Examiner, there cannot be - Ji's proxy servers only operate by reviewing data that is in 
FTP or File Transfer Protocol or SMTP or Simple Message Transfer Protocol. Thus, the 
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Examiner's statement that Ji operates by reviewing packets is incorrect. Therefore, 
Applicant respectfully disagrees with the Examiner's assertions that Ji's proxy servers 
operate as do the protocol parser of claim 1 by examining packets and intercepting 
packets. They don't and they can't They only can examine files and messages which are 
specifically being sent to the FTP or SMTP ports. 

In contrast, the protocol parser of claim Tneeds to examine the transferred code 
to determine what protocol is being used. Hence the '"parsing" of protocols. In the parent 
application, 09/244,154, which disclosure is incorporated herein by reference, Applicant 
has provided an explanation of how a parser works "Parsers are used to discriminate 
among different protocols implemented on top of the transport layer/' (page 16) There is 
no discrimination in Ji: either the SMTP proxy server or FTP proxy server receives the 



By using a protocol parser, the invention of claim 1 is able to interpret packets or 
frames, if desired This means that the initial part of a received frame is decoded for the 
protocol header that it contains, (see, Microsoft Security Bulletin, MS00-083 discussing 
the use of protocol parsers in Network Monitoring Software, at p. 3, copy enclosed and 
available at \vAvw.microsofi^com/teclmet/securitv/buHerin- : M 

Thus, Applicant again submits, the Examiner's rejection is misplaced. Ji's proxy 
servers do not examine and intercept packets. 

Finally, as Applicant notes below with respect to the Examiner's rejection to claim 
2, the Examiner is apparently also asserting the proxy servers of Ji are the protocol 
scanners of claim 2. With all due respect, such cannot be the case. First, as noted above, 
the Examiner is asserting those proxy servers are the protocol parsers of claim 1. The 
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same proxy server cannot be a protocol parser and a protocol scanner at the same time - 
the Examiner is impermissibly attempting to have one prior art element equal two elements 
here. That cannot be, it is submitted, appropriate grounds for a rejection. 

Accordingly, for the reasons set forth above, Applicant respectfully requests the 
Examiner withdraw the rejection to claim 1 and permit the claim to proceed to allowance. 

Claim 2 depends from claim 1 , and the Applicant submits the above arguments 
with regard to the elements of claim 1 also apply here. In addition, claim 2 contains a 
protocol scanner element. The Examiner's rejection of the claim states that Ji "discloses 
whereby the protocol parser transmits the code to the proscribed code scanner through the 
protocol scanner col. 7, lines 29-65." Applicant has carefully reviewed the citation to Ji, 
and nowhere is able to discern a protocol scanner. 

If the Examiner is asserting that Applicant's protocol scanner is disclosed by Ji's 
proxy server, then Applicant respectfully disagrees. Moreover, the Examiner has already 
equated Applicant's protocol parser to Ji's proxy server. Applicant respectfully submits 
the Examiner cannot have one element in Ji equal two in Applicant's claim 2. 

Accordingly, for the reasons set forth above, Applicant respectfully requests the 
Examiner withdraw the rejection to claim 2 and permit the claim to proceed to allowance. 

As claim 3 depends from claim 2, and thus has the limitations of that claim, and 
claim 4 depends from claim 3 and has the limitations of that claim, Applicant respectfully 
submits the above arguments regarding patentability of claim 2 and its independent claim 1 
apply to the patentability of dependant claims 3 and 4 as well. 

Claim 5 depends from claim 1, and shares the limitations of that claim. Thus, 
Applicant submits, the arguments above with regard to claim 1 apply to this claim as well. 
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Additionally, claim 5 has additional limitations. The Examiner has cited the 

following language from Ji, col. 9, lines 1-27 as disclosing "a configuration means for 

configuring interception parameters. But Applicant cannot find any mention of a 

configuration means in the cited language, which reads: 

the gateway node. Then in step 652, the temporarily stored file is analyzed to 
determine if it contains viruses. The analysis here is the same as step 618. In step 
652, the output of the virus checking program is preferably echoed to the client 
task 72 by the FTP proxy server 60 as part of a reply message. Next in step 656, 
the method determines whether any viruses were detected If no viruses are 
detected, the method continues in step 648 as has been described above. However, 
if a virus is detected, the present invention retrieves the configuration file to 
determine the handling of the temporary file. In step 660, the FTP proxy server 60 
determines if it is to ignore the existence of a virus and a continue the. file transfer. 
If so the method continues in step 648 where the file is passed to the client task 72 
and the temporary file is erased. If not the method continues to step 662 where the 
temporary file is erased, and the file is either deleted and not sent to the client task 
72 or the file is renamed, stored on the gateway node 33, and the client task 72 is 
notified of new name and path so that the file may be manually retrieved by the 
system administrator. The method then ends. As can be seen from FIG. 5B, the 
data transfer request is passed from the client task 72, to the FTP proxy server 60, 
then to the FTP daemon 78, and to the server task 82 which in response sends the 
file through the third port to the FTP daemon 78, and through the second port 80 
on to the FTP proxy server 60, and finally through the first port 76 to the client 



With all due respect, there is no mention anywhere of any configuration means for 
configuring interception parameters in the cited language. Thus, Applicant submits, Ji 
does not stand for the proposition cited. 

Claim 6, which depends from claim 2, has the limitations of that claim and so, 
Applicant submits, the arguments above with regard to claim 2 apply here as well. 

Additionally, Applicant submits, the Examiner's citation of Ji as "disclosing] 
wherein the protocol scanner includes a configuration means for configuring interception 
parameters (see col. 7, lines 5 1-67)" does not stand for the Examiner's proposition. The 



task 72* 
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language reads: 

and ends. However, if it is determined in step 610 that the file to be transferred is 
of a type that can contain viruses, the method proceeds to step 614. In step 614, 
the FTP proxy server 60 transfers the file from the client to the FTP proxy server 
60 through the first port 76, and in step 616, the file is temporarily stored at the 
gateway node 33. Then in step 618, the temporarily stored file is analyzed to 
determine if it contains viruses. This is preferably done by invoking a virus- 
checking program on the temporarily stored file. For example, a program the 
performs a version of signature scanning virus detection such as PC-Cillin 
manufactured and sold by Trend Micro Devices Incorporated of Cupertino, Calif, 
may be used However, those skilled in the art will realize that various other virus 
detection methods may also be used in step 618. In step 620, output of the virus 
checking program is preferably echoed to the user/client task 72 by the FTP proxy 
server 60 as part of a reply message. Next in step 

There is no configuration means referred to. Therefore, Applicant submits, the 
rejection cannot stand. 

Claim 7 is an independent claim with similar limitations to claim 2. The Examiner 
has cited Ji as disclosing "a protocol parser (see col. 5, lines 39-66); [and] a protocol 
scanner (see col. 7, lines 29-65).'* As was noted above with regard to claim 2 and its 
independent claim 1, Applicant is unable to find anywhere in Ji a mention of either a 
protocol parser or protocol scanner. Additionally, as was noted above, the Examiner 
appears to be using the proxy server of Ji as a protocol parser as well as a protocol 
scanner. This cannot be done. 

Claim 8, which was amended by preliminary amendment, and is again amended 
herein, has the limitation of "parsing said code via protocol parsing ." Ji does not 
mention, discuss, disclose, teach nor provide any motivation to "pars[e]... code via 
protocol parsing ." The proxy server of Ji in no way parses any code. Nor can Applicant 
find any mention in Ji of any other parsing. 

Claims 9-13 depend from claim 8 and share the limitations of that claim. Thus, it is 
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submitted, the arguments above with regard to claim 8 apply to claims 9-13 as well. 

Conclusion 

Claims 1-13 define patentable subject matter over the art of record and are not 
anticipated by nor obvious in view of the references of record A Notice of Allowance is 
respectfully solicited. 



Respectfully Submitted, 




Dated: March 11, 2004 
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Registration No. 33,481 
Attorney for Applicant 
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